Time-Aware Dynamic Binary Instrumentation by Pansy Arafa A thesis presented to the University of Waterloo in fulfillment of the thesis requirement for the degree of Doctor of Philosophy in Electrical and Computer Engineering Waterloo, Ontario, Canada, 2017 c Pansy Arafa 2017 Examining Committee Membership The following served on the Examining Committee for this thesis. The decision of the Examining Committee is by majority vote. External Examiner Sathish Gopalakrishnan Associate Professor, University of British Columbia, Electrical and Computer Engineering Department Supervisor Sebastian Fischmeister Associate Professor, University of Waterloo, Electrical and Computer Engineering Department Internal Member Hiren Patel Associate Professor, University of Waterloo, Electrical and Computer Engineering Department Internal Member Werner Dietl Assistant Professor, University of Waterloo, Electrical and Computer Engineering Department Internal-external Member William Cowan Associate Professor, University of Waterloo, David R. Cheriton School of Computer Science ii This thesis consists of material all of which I authored or co-authored: see Statement of Contributions included in the thesis. This is a true copy of the thesis, including any required final revisions, as accepted by my examiners. I understand that my thesis may be made electronically available to the public. iii Statement of Contribution In what follows is a list of publications which I have co-authored and used their content in this dissertation. For each publication, I present a list of my contributions. The use of the content, from the listed publications, in this dissertation has been approved by all co-authors. Dynamic Instrumentation Work: 1. Pansy Arafa, Hany Kashif, and Sebastian Fischmeister. Dime: Time-aware Dy- namic Binary Instrumentation Using Rate-based Resource Allocation. In Proceedings of the 13th International Conference on Embedded Software (EMSOFT), Montreal, Canada, September 2013 [17]. { Co-designed DIME; { Developed the three implementations of DIME; { Analyzed the experimental results; { Co-conducted the case studies; { Wrote portions of the paper. 2. Pansy Arafa, Hany Kashif, and Sebastian Fischmeister. Time-aware Dynamic Bi- nary Instrumentation (Journal Version). Under Submission. { Co-designed and implemented the redundancy-suppression feature; { Analyzed the experimental results; { Conducted the case studies; { Designed and conducted the parameter tuning experiments; { Analyzed the parameter tuning results; { Wrote the majority of the paper. 3. Pansy Arafa, Guy Martin Tchamgoue, Hany Kashif, and Sebastian Fischmeister. QDIME: QoS-aware Dynamic Binary Instrumentation. In Proceedings of the 25th International Symposium on the Modeling, Analysis, and Simulation of Computer and Telecommunication Systems (MASCOTS), Banff, Canada, September 2017 [19]. { Co-designed and implemented Qdime; iv { Co-designed and conducted the case studies; { Analyzed the results; { Wrote portions of the paper. Preliminary Work: 4. Pansy Arafa, Daniel Solomon, Samaneh Navabpour, Sebastian Fischmeister. De- bugging Behaviour of Embedded-Software Developers: An Exploratory Study. In Pro- ceedings of the Symposium on Visual Languages and Human-Centric Computing (VL/HCC), Raleigh, USA, October 2017 [18]. { Coded the study videos with the co-authors; { Analyzed the experimental results; { Wrote the paper. 5. Hany Kashif, Pansy Arafa, and Sebastian Fischmeister. INSTEP: A Static Instru- mentation Framework for Preserving Extra-functional Properties. In Proceedings of the 19th International Conference on Embedded and Real-Time Computing Systems and Applications (RTCSA), Taipei, Taiwan, August 2013 [55]. { Contributed to the design of INSTEP; { Executed static analysis and WCET analysis of the benchmarks; { Wrote portions of the paper. 6. Joachim Denil, Hany Kashif, Pansy Arafa, Hans Vangheluwe, and Sebastian Fis- chmeister. Instrumentation and Preservation of Extra-functional Properties of Simulink Models. In Proceedings of the Symposium on Theory of Modeling and Simulation - DEVS Integrative M&S Symposium, Alexandria, USA, April 2015 [32]. { Co-designed the instrumentation framework; { Wrote a portion of the paper. v Abstract The complexity of modern software systems has been rapidly increasing. Program debugging and testing are essential to ensure the correctness of such systems. Program analysis is critical for understanding system's behavior and analyzing performance. Many program analysis tools use instrumentation to extract required information at run time. Instrumentation naturally alters a program's timing properties and causes perturbation to the program under analysis. Soft real-time systems must fulfill timing constraints. Missing deadlines in a soft real-time system causes performance degradation. Thus, time- sensitive systems require specialized program analysis tools. Time-aware instrumentation preserves the logical correctness of a program and respects its timing constraints. Current approaches for time-aware instrumentation rely on static source-code instrumentation tech- niques. While these approaches are sound and effective, the need for running worst-case execution time (WCET) analysis pre- and post-instrumentation reduces the applicability to only hard real-time systems where WCET analysis is common. They become imprac- tical beyond microcontroller code for instrumenting large programs along with all their library dependencies. In this thesis, we introduce theory, method, and tools for time-aware dynamic instru- mentation realized in DIME tool. DIME is a time-aware dynamic binary instrumentation framework that adds an adjustable bound on the timing overhead to the program under analysis. DIME also attempts to increase instrumentation coverage by ignoring redundant tracing information. We study parameter tuning of DIME to minimize runtime overhead and maximize instrumentation coverage. Finally, we propose a method and a tool to in- strument software systems with quality of service (QoS) requirements. In this case, DIME collects QoS feedback from the system under analysis to respect user-defined performance constraints. As a tool for instrumenting soft real-time applications, DIME is practical, scalable, and supports multi-threaded applications. We present several case studies of DIME instrumenting large and complex applications such as web servers, media players, control applications, and database management systems. DIME limits the instrumentation overhead of dynamic instrumentation while achieving a high instrumentation coverage. vi Acknowledgements First and foremost, I am grateful to God for bestowing upon me the strength and the knowledge to complete the research work for this thesis. I am deeply thankful to my supervisor Professor Sebastian Fischmeister, for the oppor- tunities, the guidance, and the continuous support. His advice and consideration assisted me to acquire invaluable skills and find my passion. I would also like to thank my com- mittee members: Professor William Cowan, Professor Hiren Patel, Professor Werner Dietl, and Professor Satish Gopalakrishnan for taking the time and the effort to participate in my examination committee and provide me with valuable feedback. No words can describe my gratitude to my parents, Sahar and Mohammad. I would not have been here without their sacrifices, kindness, and unlimited support. I thank my mother for always being my closest friend and my role model. Her words and prayers lighten up my days. Thanks to my father for being my backbone in this life. I would like to thank my brother Ahmed and his family whom I miss every day. Also, thanks to my brother Mostafa who always makes me proud. Huge thanks to my lifetime friends for their words of support and encouragement. Thanks to my little son, Adham; his innocent smiles cheer up my days, and his hugs give me all the strength of the world. Last, but not least, I would like to express my endless gratitude to my husband, Hany. Thanks for pushing me to chase my dreams. Thanks for being the most loving and understanding husband. Thanks for everything beautiful we have together. vii Dedication To my beloved husband, Hany. To my dear son, Adham. To my parents, Sahar & Mohammad. To my siblings, Ahmed & Mostafa. viii Table of Contents List of Tables xiii List of Figures xiv 1 Introduction1 1.1 Motivation....................................1 1.2 Real-time Systems...............................3 1.3 Program Analysis................................3 1.4 Time-aware Instrumentation..........................5 1.5 Pin Framework.................................5 1.6 Rate-based Resource Allocation........................8 1.7 Goals and Contributions............................8 1.8 Organization..................................9 2 Related Work 10 2.1 Static Instrumentation Frameworks...................... 10 2.2 Dynamic Instrumentation Frameworks.................... 10 2.3 Pin-based DBI Frameworks.......................... 11 2.4 Static Time-aware Instrumentation...................... 13 2.5 Program Sampling............................... 14 ix 3 DIME: Time-Aware Dynamic Binary Instrumentation 16 3.1 Overview of DIME............................... 16 3.2 Implementation Using Pin........................... 18 3.2.1 Trace Version .............................. 21 3.2.2 Strict Trace Version .......................... 23 3.2.3 Trace Conditional ............................ 25 3.2.4 Qualitative Comparison........................ 26 3.3 Performance Evaluation...........................